Data protection in marketing simply explained – the basics of advertising communication

von Carolin

At least since the introduction of the GDPR two years ago, data protection has been a much discussed topic in marketing. At the same time, advertising communication is more complex than ever today. Terms such as content marketing, big data, retargeting, SEM, SEO and SEA are on everyone’s lips. In this article we shed light on the basics of promotional communication in both new and old media.

What is meant by advertising communication anyway?

Advertising communication and advertising measures do not only include classic brochures and flyers. Rather, the term advertising is to be interpreted broadly according to the case law of the Federal Court of Justice. This means that all statements made by a company that are suitable to drive demand for its own product are to be viewed as advertising.

This also includes the new forms of communication between a company and its customers – such as newsletters and surveys on customer satisfaction.

But when and how can a company advertise?

Advertising falls under the company’s freedom of occupation, which is protected by Article 12 of the Basic Law. This means that a company is fundamentally free to decide how and to what extent advertising is communicated. However, there are legal limits to this right. Advertising must not impair the rights and freedoms of other people or companies.

These barriers set u. a.

  • the law against unfair competition (UWG)
  • Laws to protect minors
  • Rules for advertising certain products (e.g. alcohol, tobacco products)
  • Data protection laws (GDPR, BDSG new)


The most important legal basis for GDPR-compliant advertising is the declaration of consent of the persons addressed in the advertising.

What requirements does consent have to meet in data protection law? How long is it valid?

The advantages of the declaration of consent within the meaning of Art. 7 GDPR are obvious. For one thing, a person who voluntarily agrees to receive advertising is more receptive to promotional content. On the other hand, the consent fully safeguards the so-called right to informational self-determination of the applicant. This means that each person can decide for themselves which company they want to receive advertising from.

The conditions for a valid consent are laid down in Art. 7 GDPR. These are as follows:

  • Voluntariness: Submitting the declaration of consent must always be voluntary.
  • Coupling prohibition: A contract signature may e.g. B. not be a consent for promotional communication at the same time.
  • Earmarking: The data made available for advertising may only be used for the specified advertising.
  • Revocation: A given consent must be revocable at any time and in a simple form.
  • Optical highlighting: The declaration of consent must not be hidden in a contract, for example, but must be highlighted.
  • Verifiability: The advertising company must be able to prove the consent of the data subjects.
  • Simple language: Consent must be submitted in simple and clear language.

A legally compliant consent is valid until it is revoked by the person concerned. Invalid or nonexistent declarations of consent must not be the basis of an advertising measure and must be obtained again immediately.

What is a “legitimate interest”? What is to be considered?

In data protection law, the so-called “legitimate interest” of the person responsible (= company) in accordance with Art. 6 para. 1 lit. f GDPR spoken.

As mentioned in the previous section, the consent of the data subject is the most important way of legitimizing data processing for an advertising measure. However, there is also the possibility that advertising communication is so essential for a company that there is a “legitimate interest” in specific advertising. If this is the case, an advertising measure is also permitted without the signed consent of the advertising recipient.

The criteria of Section 7 UWG are used to assess when such a legitimate interest exists. This means that an advertising measure can be permitted without the consent of the recipient. To do this, the criteria of the UWG must be met. Then the data processing necessary for advertising also corresponds to the “legitimate interest” according to GDPR.

There are the following applicable case groups:

  • postal advertising, direct mail
  • Cold calling by telephone if the company is presumed to be interested in the advertised product
  • E-mail advertising under the strict requirements of Section 7 (3) UWG


In summary, it can be said that there are a few things to consider in advertising communication. The safest way to act in compliance with the GDPR is to give your consent.

Would you like to make your marketing department aware of the issue of data protection in your company in order to avoid data breaches and GDPR violations? For example, we can support you with on-site awareness training or online alternatives, and we can also provide you with an external DPO. Call us on 08505 919 27-0 or fill out our contact form.


Carolin verfügt als geprüfte kaufmännische Betriebswirtin über mehrjährige Berufserfahrung im Bereich Datenschutz und behält den Blick fürs Ganze. Ihre Erfahrungen aus dem kaufmännischen Bereich verknüpft sie bereichernd mit ihrer Qualifikation als TÜV-zertifizierte Datenschutzbeauftragte. Die praktische Umsetzung der DSGVO, individuelle Lösungsansätze für Unternehmen sowie Datenschutz im Gesundheitswesen sind ihre Spezialgebiete. Ihre Tätigkeitsschwerpunkte liegen in der Erstellung von Konzepten, Prozessoptimierungen sowie der praxisnahen und lösungsorientierten Umsetzung des Datenschutzes in Unternehmen.